SUSE Security Update: Security update for tomcat
______________________________________________________________________________

Announcement ID: SUSE-SU-2017:1660-1
Rating: important
References: #1007853 #1007854 #1007855 #1007857 #1007858
#1011805 #1011812 #1015119 #1033447 #1033448
#986359 #988489
Cross-References: CVE-2016-0762 CVE-2016-3092 CVE-2016-5018
CVE-2016-5388 CVE-2016-6794 CVE-2016-6796
CVE-2016-6797 CVE-2016-6816 CVE-2016-8735
CVE-2016-8745 CVE-2017-5647 CVE-2017-5648

Affected Products:
SUSE Linux Enterprise Server for SAP 12
SUSE Linux Enterprise Server 12-LTSS
______________________________________________________________________________

An update that fixes 12 vulnerabilities is now available.

Description:

Tomcat was updated to version 7.0.78, fixing various bugs and security
issues.

For full details see
https://tomcat.apache.org/tomcat-7.0-doc/changelog.html

Security issues fixed:

– CVE-2016-0762: A realm timing attack in tomcat was fixed which could
disclose existence of users (bsc#1007854)
– CVE-2016-3092: Usage of vulnerable FileUpload package could have
resulted in denial of service (bsc#986359)
– CVE-2016-5018: A security manager bypass via a Tomcat utility method
that was accessible to web applications was fixed. (bsc#1007855)
– CVE-2016-5388: Setting HTTP_PROXY environment variable via Proxy header
(bsc#988489)
– CVE-2016-6794: A tomcat system property disclosure was fixed.
(bsc#1007857)
– CVE-2016-6796: A tomcat security manager bypass via manipulation of the
configuration parameters for the JSP Servlet. (bsc#1007858)
– CVE-2016-6797: A tomcat unrestricted access to global resources via
ResourceLinkFactory was fixed. (bsc#1007853)
– CVE-2016-6816: A HTTP Request smuggling vulnerability due to permitting
invalid character in HTTP requests was fixed. (bsc#1011812)
– CVE-2016-8735: A Remote code execution vulnerability in
JmxRemoteLifecycleListener was fixed (bsc#1011805)
– CVE-2016-8745: A Tomcat Information Disclosure in the error handling of
send file code for the NIO HTTP connector was fixed. (bsc#1015119)
– CVE-2017-5647: A tomcat information disclosure in pipelined request
processing was fixed. (bsc#1033448)
– CVE-2017-5648: A tomcat information disclosure due to using incorrect
facade objects was fixed (bsc#1033447)

Patch Instructions:

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

– SUSE Linux Enterprise Server for SAP 12:

zypper in -t patch SUSE-SLE-SAP-12-2017-1027=1

– SUSE Linux Enterprise Server 12-LTSS:

zypper in -t patch SUSE-SLE-SERVER-12-2017-1027=1

To bring your system up-to-date, use “zypper patch”.

Package List:

– SUSE Linux Enterprise Server for SAP 12 (noarch):

tomcat-7.0.78-7.13.4
tomcat-admin-webapps-7.0.78-7.13.4
tomcat-docs-webapp-7.0.78-7.13.4
tomcat-el-2_2-api-7.0.78-7.13.4
tomcat-javadoc-7.0.78-7.13.4
tomcat-jsp-2_2-api-7.0.78-7.13.4
tomcat-lib-7.0.78-7.13.4
tomcat-servlet-3_0-api-7.0.78-7.13.4
tomcat-webapps-7.0.78-7.13.4

– SUSE Linux Enterprise Server 12-LTSS (noarch):

tomcat-7.0.78-7.13.4
tomcat-admin-webapps-7.0.78-7.13.4
tomcat-docs-webapp-7.0.78-7.13.4
tomcat-el-2_2-api-7.0.78-7.13.4
tomcat-javadoc-7.0.78-7.13.4
tomcat-jsp-2_2-api-7.0.78-7.13.4
tomcat-lib-7.0.78-7.13.4
tomcat-servlet-3_0-api-7.0.78-7.13.4
tomcat-webapps-7.0.78-7.13.4

References:

https://www.suse.com/security/cve/CVE-2016-0762.html
https://www.suse.com/security/cve/CVE-2016-3092.html
https://www.suse.com/security/cve/CVE-2016-5018.html
https://www.suse.com/security/cve/CVE-2016-5388.html
https://www.suse.com/security/cve/CVE-2016-6794.html
https://www.suse.com/security/cve/CVE-2016-6796.html
https://www.suse.com/security/cve/CVE-2016-6797.html
https://www.suse.com/security/cve/CVE-2016-6816.html
https://www.suse.com/security/cve/CVE-2016-8735.html
https://www.suse.com/security/cve/CVE-2016-8745.html
https://www.suse.com/security/cve/CVE-2017-5647.html
https://www.suse.com/security/cve/CVE-2017-5648.html
https://bugzilla.suse.com/1007853
https://bugzilla.suse.com/1007854
https://bugzilla.suse.com/1007855
https://bugzilla.suse.com/1007857
https://bugzilla.suse.com/1007858
https://bugzilla.suse.com/1011805
https://bugzilla.suse.com/1011812
https://bugzilla.suse.com/1015119
https://bugzilla.suse.com/1033447
https://bugzilla.suse.com/1033448
https://bugzilla.suse.com/986359
https://bugzilla.suse.com/988489

—
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org